Rsfirewall Vulnerabilities

The RSFirewall! plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.45 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses...

CVSS:

7.2

Affected:

up to 1.1.45

Fixed in:

1.1.46

Disclosed:

Mar 23, 2026

CVE-2026-25341 on NVD →

The RSFirewall! plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.1.42 via the get_local_filename() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to read the contents of arbitrary files on the server, which can contain...

CVSS:

4.9

Affected:

up to 1.1.42

Fixed in:

1.1.43

Disclosed:

Jul 11, 2025

CVE-2025-7518 on NVD →

The RSFirewall! plugin for WordPress is vulnerable to IP Address Spoofing in versions less than and equal to 1.1.24 due to insufficient IP address validation. This makes it possible for attackers to bypass blocks and access services they should not be able to.

CVSS:

6.5

Affected:

up to 1.1.24

Fixed in:

1.1.25

Disclosed:

Apr 13, 2022

CVE-2021-4226 on NVD →